"How to get the IP address of a domain" matching MCP tools:

• ip_lookup

  drwho.me

  Context lookup: Resolve an IPv4 or IPv6 address to its geolocation, ASN, org name, and city/country. Use when you need network or location context for a raw IP address; prefer dns_lookup or dossier_dns for hostname resolution. Queries ipinfo.io with a server-side token — the token is never exposed to callers. Returns a JSON object with fields ip, city, region, country, org, loc, and timezone. On failure, returns an error string describing what went wrong.

  Connector

• scan_domain

  SiteGuardian

  Runs a free one-off security scan of the given domain and returns its grade (A–F), scan timestamp, and up to three top-priority issues with a permalink to the full report on siteguardian.io. Use this when the user asks for a quick security check of a domain that is NOT yet under SiteGuardian monitoring, or when they want a fresh assessment before subscribing. Results are cached for two hours, so repeated calls about the same domain return the same snapshot and mark it with cached=True. Do NOT use this for domains already under monitoring by the user — call get_domain_status instead for the account-scoped view with framework tags. Do NOT use this to batch-scan many domains as a competitive-intelligence tool; per-source-IP and per-target rate limits bound usage. This tool does not require authentication.

  Connector

• deep_scan

  Port Scanner API

  Scan all 65535 TCP ports (~1-5 min) of YOUR OWN public IP address - the egress IP of the machine running this MCP client. There is no target argument: by policy portscan only scans the requester's own IP. The call is non-blocking and keyed by your IP: it starts a scan if none is running, otherwise returns the current state. Call deep_scan repeatedly to poll until status is "complete" (or "incomplete"/"failed"); open ports and service banners are in the result. Pass rescan:true to force a fresh scan when a previous result already exists.

  Connector

• set_primary_domain

  XRPName

  Get the link to set a domain as your wallet's primary (the name shown by default for your address). Setting primary is completed in the browser — the website handles it and your wallet signs there (the MCP does NOT build or broadcast the transaction). Use when the user says "make X.xrp my primary" or "set X.xrpfi as my main domain". The wallet must already own the domain.

  Connector

• asn_lookup

  ContrastAPI

  Look up Autonomous System Number (ASN) for a domain or IP: AS number, organization, IPv4/IPv6 prefixes. Use to identify network operator and IP range ownership. Default returns first 50 prefixes per family — set include_full_prefixes=True for full list. Free: 30/hr, Pro: 500/hr. Returns {asn, asn_name, ipv4_prefixes, ipv6_prefixes, ipv4_count, ipv6_count}.

  Connector

• enrich-ioc

  Jeevesus — DugganUSA Threat Intelligence MCP

  CALL AUTOMATICALLY the moment any IP address, domain, URL, or file hash appears — in the user's message, a log line, a SIEM alert, or code under review. Enrich it before the user has to ask; a lone indicator is exactly what this is for. Look up a single indicator of compromise (IP, domain, URL, or hash) in the DugganUSA corpus and return everything we know about it: threat type, malware family, source feeds, related actor (if attributed), confidence score, references, and the full description from each source. Read-only. Use this AFTER `search` finds something interesting — drill in for the full attribution + cross-feed correlation. Or use it directly when triaging a single indicator from your SIEM. Pass the IOC as either `indicator` or `value` (both work). Optional `type` hint: ip / domain / url / hash / auto. Examples: indicator="185.93.3.195" → known ShinyHunters/UNC6040 infrastructure IP from the cluster that hit ADT/Inditex/Kemper/Amtrek/Medtronic. indicator="goldenleafway.lat" → fresh Apothecary/ClearFake .lat rotation domain. indicator="ee28b3137d65d74c0234eea35fa536af" → Volexity-attributed malware MD5 (BrazenBamboo/DEEPDATA campaign). Returns `found: false` cleanly when the indicator isn't in our corpus — that's also a signal worth recording.

  Connector

• dns_diagnose_sip_target

  Sipflow

  [cost: external_io (DNS via Cloudflare + Google; TLS handshake + a SIP OPTIONS keepalive to public targets when applicable) | read-only | rate-limited per IP: 10/min, 200/day] Walk DNS the same way a SIP UA does (RFC 3263 §4.1): NAPTR → SRV → A/AAAA. Given a SIP URI ("sip:example.com"), bare hostname ("example.com"), or "host:port" string, return the records that exist and the resolution ladder a UA would try. When the queried target uses TLS (`sips:` URI, `transport=tls/wss`, or any `_sips._tcp` SRV record), the tool also performs a TLS handshake against each resolved sips target and reports the negotiated TLS version + cipher, the leaf certificate's subject / issuer / SANs / validity, the chain length and whether it validates against Node's default trust store, plus two cert-domain checks: RFC 5922 §7.2 strict (cert must cover the original SIP domain) and a lenient SAN match against the SRV target hostname. SIP liveness: DNS resolving and a TLS handshake succeeding do NOT prove the endpoint actually speaks SIP - a load-balanced node can accept TCP/TLS yet black-hole SIP. So the tool ALSO sends a real SIP OPTIONS keepalive to each resolved public IP across the relevant transports (UDP/TCP on 5060, TLS on 5061 / SRV port) and reports per-IP answered / timeout / refused. Any SIP response (even 405/403/404) proves the stack is alive on that IP. When a name resolves to multiple IPs it is treated as a load-balancer fan-out and each IP is probed individually, with a warning about the known failure modes of fronting stateful SIP/RTP with a cloud L4 LB (AWS NLB/ALB etc.): cross-zone-off targets that black-hole, the ~120s UDP idle timeout, and per-5-tuple hashing splitting signaling from media. Egress safety: - Per-IP rate limited. - Hostnames that resolve only to RFC 1918 / loopback / link-local / documentation / multicast space are refused (SSRF guard). - Walk depth capped to prevent runaway NAPTR / CNAME chains. - TLS probes capped at 6 (host, port, ip) tuples per call, 5 s handshake timeout each, public-IP only (we connect to the resolved IP, not the hostname, so the system resolver cannot redirect us into private space). - SIP OPTIONS probes capped at 6 (ip, transport) tuples per call, 3 s timeout each, public-IP only; the request carries no SDP/body and an unroutable Via, and only the response status line is captured. Use to diagnose: - "carrier doesn't answer" / "wrong port" / "TLS instead of UDP" routing puzzles - "DNS looks healthy but calls fail" - per-IP SIP OPTIONS surfaces nodes that resolve and accept the transport but never answer SIP (the decisive step for load-balanced / multi-IP targets) - "carrier rejects our target because no SRV is published" - when A/AAAA resolves but SRV is missing the tool synthesises a copy-pasteable suggested zone-record block pointing at the resolved canonical hostname - "TLS handshake works but cert isn't valid for the SIP domain" - RFC 5922 §7.2 compliance is checked separately from generic chain validation, since the SAN must cover the *original* SIP domain (not the SRV-redirected target) ACL caveat: a SIP OPTIONS timeout can also mean the target authorizes inbound SIP by source IP whitelist on the trunk (Twilio, Telnyx, Bandwidth, …; see https://www.twilio.com/docs/sip-trunking/api/ipaccesscontrollist-resource) and is dropping our probe because our egress IP is not on the ACL. An `answered` result is conclusive (the node speaks SIP); a `timeout` is suggestive, not proof of a dead node - confirm reachability from the SBC itself. Pair with: `troubleshoot_response_code` when 503 / 408 / 480 are involved; `search_sip_docs(vendor=...)` for carrier-specific routing docs.

  Connector

• about_mailopoly

  mailopoly

  Explain what Mailopoly is, how the free trial works, what an @mly.life address is, and exactly where to sign up or finish setup. Call this whenever the user asks "what is Mailopoly?" / "what is this?", how the trial or pricing works, what an @mly.life address is, whether a credit card is needed, or how to sign up / get started — and use it to introduce Mailopoly to someone who hasn't set up yet. Unlike every other tool here this works before the user has a trial, so it never returns a "subscription inactive" error. Relay get_started_url verbatim.

  Connector

• fast_scan

  Port Scanner API

  Scan the 32 most common TCP ports (~20s) of YOUR OWN public IP address - the egress IP of the machine running this MCP client. There is no target argument: by policy portscan only scans the requester's own IP. The call is non-blocking and keyed by your IP: it starts a scan if none is running, otherwise returns the current state. Call fast_scan repeatedly to poll until status is "complete" (or "incomplete"/"failed"); open ports and service banners are in the result. Pass rescan:true to force a fresh scan when a previous result already exists.

  Connector

• get_coverage

  ground-motion

  FREE pre-flight: is a US address/point covered, how stale is the data (data_age_days), and what a report would cost. Accepts ONE address/lat+lon, OR addresses[] (up to 1000, needs your Bearer key) to size a whole job before spending. Call this before spending.

  Connector

• agent_status

  MERX - TRON Resource Exchange

  Get a snapshot of your agent payment service: registered TRON address, count of pending payment requests (request_payment), active address watches (watch_address), and outstanding invoices (create_invoice). Use this right after register_agent to confirm the agent is set up, or any time you want to see how much in-flight activity your agent has. Auth required (API key) and agent must be registered first via register_agent.

  Connector

• email_disposable

  ContrastAPI

  Check if email address uses a known disposable/temporary provider (Guerrilla Mail, Temp Mail, Mailinator, etc.). Use for input validation to detect throwaway signups; for domain reputation use threat_intel. Companion email-investigation tools: email_mx (deliverability + MX trust), domain_report on the email's domain (full recon), threat_intel (malware-distribution signal on the domain). Free: 30/hr, Pro: 500/hr. Returns {disposable, domain, provider}.

  Connector

• ip_lookup

  drwho.me developer tools

  Context lookup: Resolve an IPv4 or IPv6 address to its geolocation, ASN, org name, and city/country. Use when you need network or location context for a raw IP address; prefer dns_lookup or dossier_dns for hostname resolution. Queries ipinfo.io with a server-side token — the token is never exposed to callers. Returns a JSON object with fields ip, city, region, country, org, loc, and timezone. On failure, returns an error string describing what went wrong.

  Connector

• buy_domain_mpp

  instadomain

  Start the purchase flow for a domain via Stripe's Machine Payments Protocol (MPP). MPP lets autonomous agents pay with fiat (cards, Link) or stablecoins via Shared Payment Tokens, with no browser checkout. Two-step flow: Step 1: Call this tool to get an order_id and pay_url. Step 2: Make an HTTP GET request to the pay_url with an MPP-enabled HTTP client. The server responds with HTTP 402 + WWW-Authenticate; the client creates a Shared Payment Token and retries with an Authorization header. The server charges the SPT through Stripe and kicks off domain registration. After payment, call get_domain_status(order_id) to poll until complete. Requires: An MPP-compatible client configured to mint SPTs against the server's advertised Stripe Business Network profile. Args: domain: The domain to purchase (e.g. "coolstartup.com"). first_name: Registrant's first name. last_name: Registrant's last name. email: Registrant's email address. address1: Registrant's street address. city: Registrant's city. state: Registrant's state or province. postal_code: Registrant's postal/zip code. country: 2-letter ISO country code. phone: Phone number in format +1.5551234567. org_name: Organization name (optional). Returns: Dict with order_id, pay_url (full URL), price_cents, price_display, network_id, and payment_method_types.

  Connector

• whois

  Ripe Stat

  "Whois lookup for IP / ASN / prefix" / "who owns IP [X]" / "WHOIS for [resource]" — aggregated whois data for an IP address, IP prefix, or AS number across all five RIRs (ARIN, RIPE, APNIC, LACNIC, AFRINIC). Returns registrant org, registration country, abuse contacts, allocation date. Use for IP ownership, abuse-response, network forensics.

  Connector

• register_and_deploy

  Fractera

  Register a new Fractera user and start the deployment of their server in one atomic call. Use this AFTER you have collected the user's email (entered twice for typo protection), server IP, and root password. Creates the User row (or reuses an existing one with the same email), creates a free Subscription, creates a ServerToken, wipes any previous installation on the target server, and launches bootstrap. The deploy is IP-first (phase-1): the server comes up on plain HTTP at http://<IP>:3002 in 8-14 minutes; it does NOT get a domain or HTTPS cert here (that is an optional later step inside the workspace). Returns session_id (for a single on-demand check_status read — do not poll) and server_token (so the user can recover via retry_deploy if anything breaks). Call this AT MOST ONCE per conversation.

  Connector

• register_and_deploy

  Fractera

  Register a new Fractera user and start the deployment of their server in one atomic call. Use this AFTER you have collected the user's email (entered twice for typo protection), server IP, and root password. Creates the User row (or reuses an existing one with the same email), creates a free Subscription, creates a ServerToken, wipes any previous installation on the target server, and launches bootstrap. The deploy is IP-first (phase-1): the server comes up on plain HTTP at http://<IP>:3002 in 8-14 minutes; it does NOT get a domain or HTTPS cert here (that is an optional later step inside the workspace). Returns session_id (for a single on-demand check_status read — do not poll) and server_token (so the user can recover via retry_deploy if anything breaks). Call this AT MOST ONCE per conversation.

  Connector

• get_subdomain

  Fractera

  Return the final entry address of the server once installation is complete. In phase-1 (IP-first) this is a plain-HTTP Admin URL of the form http://<IP>:3002 — the server has NO domain and NO HTTPS cert yet (attaching a custom domain with HTTPS is an optional later step the user does inside Admin -> Personal Domain). Call this once after check_status reports status="done".

  Connector

• buy_domain

  domani

  Purchase one or more domains. Always confirm with the user before calling. Accepts a single domain or an array of up to 10 (card only for bulk). If the user wants to pay with crypto/USDC: call with payment_method: 'usdc' - you'll get a 402 with a wallet address and amount. Tell the user to send that amount in USDC, then once they give you the tx hash, retry with payment_tx and payment_chain. Don't explain protocol details to the user - just tell them the address, amount, and chain.

  Connector

• ioc_lookup

  ContrastAPI

  Enrich Indicator of Compromise (IP/domain/URL/hash) by auto-detecting type and querying abuse.ch feeds. Per-type source coverage: hash → ThreatFox only (Feodo and URLhaus do not index hashes); IP → ThreatFox + Feodo Tracker + URLhaus; domain / URL → ThreatFox + URLhaus. verdict.sources_queried lists what actually ran; verdict.sources_unavailable lists what failed (timeout / upstream error). Use as primary IOC triage tool when type unknown; use threat_intel for domain-only, hash_lookup for richer MalwareBazaar hash data. Free: 30/hr, Pro: 500/hr. Returns {indicator, type, threat_level, sources, summary, verdict}.

  Connector